Most of the examples of XSS, I have seen examples of websites that get its parameter tampered through url query parameter. For example:

http://example.com/param1=123&param2=name&param3=<script type='text/javascript'>alert('pwnd');</script>

But if the application receives its payload not through url query parameter but through Post request body, how can attacker lure victim to perform xss by simply providing url to click? You can definitely, tamper with post body values by inserting code, but that will not be considered as XSS, since that is usually done in apps like fiddler or curl which does not run response code. So how can xss occur in this applications. As far as I understand xss does not persist data on the server, but rather affects the user who is making that request.


The issue exists if the form is csrfable, then the attacker.com website can contain some JavaScript that makes a POST request to victim.com in order to exploit the xss. It is also exploitable through other means like a HTTP 307 response.

  • I think your answer is correct. I have not thought about attackers website can make you POST forms to your already authenticated victims website. Which is what CSRF attacks are. So I guess reflected xss is very similar to csrf attacks then? – DoodleKana Feb 3 '15 at 17:35
  • if the form is not csrfable, can there be still any xss vulnerability exist? – DoodleKana Feb 3 '15 at 18:14
  • Yes, it still exist, but the likelihood of exploitation drops of significantly. If you take a look at the Browser Exploitation Framework (BeEF) you can see many examples on how various xss vulnerabilities can be exploited – wireghoul Feb 3 '15 at 21:33

There is stored XSS and DOM based XSS which do not rely upon a GET parameter. POST based XSS is exploited using a simple cross-site post request, which can be triggered using the following HTML and JavaScript

<form id=xss action=http://target/action method=POST>
  <input name=param3 value="'+alert(document.cookie)+'">
  <input type=submit>

Once the XSS payload stored in param3 is executed within the context of http://target, the Same-Origin Policy is bypassed.

  • I forgot to mention in my question that the type of xss I was referring to is reflected xss. The server does not have the payload stored(not stored xss). But the returning error message has the payload in it(reflected xss). But how does attacker make victim to send the payload through POST in reflective xss? – DoodleKana Feb 3 '15 at 16:25
  • @DoodleKana the attacker copy pastes the HTML and JavaScript in the above answer, and then gets a victim to click on a URL that loads that exploit. method=POST – rook Feb 3 '15 at 19:31
  • your right, I think @ wireghoul has also similar answer. – DoodleKana Feb 3 '15 at 20:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.